Code:
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\malignant\Windows_NT6_BSOD_jcgriff2\010812-21138-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c09000 PsLoadedModuleList = 0xfffff800`02e4e670
Debug session time: Sun Jan 8 14:13:37.980 2012 (UTC - 7:00)
System Uptime: 0 days 1:04:42.416
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800833a248, fffff88008339aa0, fffff80002c7db65}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonWrite+2f68 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800833a248
Arg3: fffff88008339aa0
Arg4: fffff80002c7db65
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800833a248 -- (.exr 0xfffff8800833a248)
ExceptionAddress: fffff80002c7db65 (nt!ExpInterlockedPopEntrySListFault16)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88008339aa0 -- (.cxr 0xfffff88008339aa0)
rax=0000000045c7ffff rbx=0000000000000060 rcx=fffff880009ebc40
rdx=dcf8d85d02c1c6d3 rsi=0000000000000007 rdi=0000000000000000
rip=fffff80002c7db65 rsp=fffff8800833a480 rbp=fffff880009ebc40
r8=dcf8d85d02c1c6d2 r9=fffff80002c09000 r10=fffff880009ebc40
r11=fffffa8003fc2550 r12=fffff80002e10340 r13=0000000000000000
r14=0000000000000002 r15=0000000070566343
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02c7db65 498b08 mov rcx,qword ptr [r8] ds:002b:dcf8d85d`02c1c6d2=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: LCDMisc64.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb8100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsCommonWrite+2f68
fffff880`012567cc ba02000000 mov edx,2
FAULTING_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02c7db65 498b08 mov rcx,qword ptr [r8]
BUGCHECK_STR: 0x24
DEVICE_OBJECT: fffffa8003bf4760
LAST_CONTROL_TRANSFER: from fffff80002db41de to fffff80002c7db65
STACK_TEXT:
fffff880`0833a480 fffff800`02db41de : fffffa80`03f124f0 fffff880`0833a528 00000000`00000004 fffff8a0`03370100 : nt!ExpInterlockedPopEntrySListFault16
fffff880`0833a490 fffff800`02f8de80 : fffffa80`00000000 00000000`00000060 00000000`00000001 00000000`00000000 : nt!ExAllocatePoolWithTag+0xfe
fffff880`0833a580 fffff800`02c9ef2f : fffff8a0`09b80f00 00000000`00300000 00000000`00000000 fffffa80`06181a20 : nt!CcCreateVacbArray+0xe0
fffff880`0833a5c0 fffff880`012567cc : fffffa80`00000000 fffff8a0`00000001 00000000`0025eb00 fffff880`0129d088 : nt!CcInitializeCacheMap+0x7df
fffff880`0833a6a0 fffff880`012571a3 : fffffa80`03d6ace0 fffffa80`03bf43c0 fffff880`0833a801 fffff880`0833a800 : Ntfs!NtfsCommonWrite+0x2f68
fffff880`0833a850 fffff880`011aabcf : fffffa80`03bf4718 fffffa80`03bf43c0 fffffa80`03f12440 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`0833a910 fffff880`011a96df : fffffa80`043ddb60 00000000`00000001 fffffa80`043ddb00 fffffa80`03bf43c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0833a9a0 fffff800`02f8e21b : 00000000`00000001 fffffa80`06181a20 00000000`00000001 fffffa80`03bf43c0 : fltmgr!FltpDispatch+0xcf
fffff880`0833aa00 fffff800`02f98c83 : fffffa80`03bf4760 00000000`00000000 fffffa80`06181a20 fffff880`009eb180 : nt!IopSynchronousServiceTail+0xfb
fffff880`0833aa70 fffff800`02c84ed3 : 00000000`00000301 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
fffff880`0833ab70 00000000`779a139a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001299a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779a139a
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: Ntfs!NtfsCommonWrite+2f68
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff88008339aa0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCommonWrite+2f68
BUCKET_ID: X64_0x24_Ntfs!NtfsCommonWrite+2f68
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\malignant\Windows_NT6_BSOD_jcgriff2\010812-19125-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c10000 PsLoadedModuleList = 0xfffff800`02e55670
Debug session time: Sun Jan 8 14:24:45.310 2012 (UTC - 7:00)
System Uptime: 0 days 0:03:44.746
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff67ffffffff5, 1, fffff80002dbb1f9, 7}
Could not read faulting driver name
Probably caused by : tcpip.sys ( tcpip!IppCreateSortedAddressPairs+161 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff67ffffffff5, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002dbb1f9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebf100
fffff67ffffffff5
FAULTING_IP:
nt!ExAllocatePoolWithTag+119
fffff800`02dbb1f9 884303 mov byte ptr [rbx+3],al
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88006ef4130 -- (.trap 0xfffff88006ef4130)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000001
rdx=fffff68000000003 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002dbb1f9 rsp=fffff88006ef42c0 rbp=fffff880009ebc40
r8=fffff68000000002 r9=fffff80002c10000 r10=fffff880009ebc40
r11=fffff88006ef4400 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!ExAllocatePoolWithTag+0x119:
fffff800`02dbb1f9 884303 mov byte ptr [rbx+3],al ds:42c0:00000000`00000003=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002c37347 to fffff80002c8cc40
STACK_TEXT:
fffff880`06ef3fc8 fffff800`02c37347 : 00000000`00000050 fffff67f`fffffff5 00000000`00000001 fffff880`06ef4130 : nt!KeBugCheckEx
fffff880`06ef3fd0 fffff800`02c8ad6e : 00000000`00000001 fffff67f`fffffff5 00000000`00000000 fffff67f`fffffff2 : nt! ?? ::FNODOBFM::`string'+0x44711
fffff880`06ef4130 fffff800`02dbb1f9 : fffffa80`070189e0 fffff880`01915ab4 fffffa80`06564100 fffffa80`074c3060 : nt!KiPageFault+0x16e
fffff880`06ef42c0 fffff880`01928c21 : 00000000`00000003 00000000`00000003 fffffa80`076c4d90 00000000`00000018 : nt!ExAllocatePoolWithTag+0x119
fffff880`06ef43b0 fffff880`019288ce : fffffa80`0542eb40 fffff880`06ef44b0 fffff880`06ef4518 fffffa80`03b755b0 : tcpip!IppCreateSortedAddressPairs+0x161
fffff880`06ef4470 fffff880`01925cd1 : fffffa80`06fe55f0 00000000`00000000 00000000`00000000 fffffa80`00000000 : tcpip!IppSortDestinationAddresses+0xfe
fffff880`06ef4500 fffff880`019265b8 : fffffa80`06566790 fffffa80`06566790 fffffa80`0626e1d0 00000000`00000000 : tcpip!IpNlpSetSessionInfo+0x191
fffff880`06ef45f0 fffff880`019258f7 : 00000000`0000fffc 00000000`00000000 00000000`c8000019 00000000`c8000019 : tcpip!InetSetSessionInformationAf+0xe8
fffff880`06ef46c0 fffff880`019253f7 : fffffa80`03b84230 fffff880`014471c0 fffffa80`03be1e50 fffff6fb`40000010 : tcpip!UdpSetSockOptEndpoint+0x2b7
fffff880`06ef47e0 fffff880`0145c0d4 : 00000000`00000001 00000000`00000000 00000000`00000001 00000980`00000000 : tcpip!UdpTlProviderIoControlEndpoint+0x77
fffff880`06ef4840 fffff880`01446ddd : fffffa80`0626e1d0 fffff880`06ef4c60 fffffa80`065641f0 fffff880`06ef4c60 : afd! ?? ::GFJBLGFE::`string'+0xa960
fffff880`06ef48b0 fffff800`02fa7a97 : fffffa80`065641f0 00000000`00000038 fffffa80`06ce5920 fffffa80`06ce5920 : afd!AfdTliIoControl+0x8bd
fffff880`06ef49d0 fffff800`02fa82f6 : fffff880`06ef4bb8 00000000`00000640 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`06ef4b00 fffff800`02c8bed3 : fffff880`06ef4c60 fffffa80`07318330 fffff880`06ef4bb8 00000980`00000000 : nt!NtDeviceIoControlFile+0x56
fffff880`06ef4b70 00000000`74e22e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`07eaf078 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74e22e09
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!IppCreateSortedAddressPairs+161
fffff880`01928c21 4885c0 test rax,rax
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: tcpip!IppCreateSortedAddressPairs+161
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e83e948
FAILURE_BUCKET_ID: X64_0x50_tcpip!IppCreateSortedAddressPairs+161
BUCKET_ID: X64_0x50_tcpip!IppCreateSortedAddressPairs+161
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\malignant\Windows_NT6_BSOD_jcgriff2\010912-29031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c11000 PsLoadedModuleList = 0xfffff800`02e56670
Debug session time: Mon Jan 9 02:47:37.118 2012 (UTC - 7:00)
System Uptime: 0 days 10:30:37.429
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, fffffa8001dbd130, fffffa8001dbd1c0, c09e172}
GetPointerFromAddress: unable to read from fffff80002ec0100
GetUlongFromAddress: unable to read from fffff80002e2ea18
Probably caused by : ntkrnlmp.exe ( nt!KiDeliverApc+2ca )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa8001dbd130, The pool entry we were looking for within the page.
Arg3: fffffa8001dbd1c0, The next pool entry.
Arg4: 000000000c09e172, (reserved)
Debugging Details:
------------------
GetUlongFromAddress: unable to read from fffff80002e2ea18
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: fffffa8001dbd130
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: CCC.exe
CURRENT_IRQL: 1
LAST_CONTROL_TRANSFER: from fffff80002dbbcae to fffff80002c8dc40
STACK_TEXT:
fffff880`0816b968 fffff800`02dbbcae : 00000000`00000019 00000000`00000020 fffffa80`01dbd130 fffffa80`01dbd1c0 : nt!KeBugCheckEx
fffff880`0816b970 fffff800`02c813fa : 00000000`00000001 00000000`00000000 00000000`70617350 00000000`00000000 : nt!ExDeferredFreePool+0x12da
fffff880`0816ba20 fffff800`02c81740 : 00000000`00000000 fffff880`0816baa0 000007fe`fdc93a70 00000000`00000000 : nt!KiDeliverApc+0x2ca
fffff880`0816baa0 fffff800`02c8cf77 : fffffa80`03c58b60 fffff880`0816bc60 80000000`00000000 fffffa80`055ea850 : nt!KiInitiateUserApc+0x70
fffff880`0816bbe0 00000000`7756165a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`1c08f8c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7756165a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiDeliverApc+2ca
fffff800`02c813fa 4c8b842490000000 mov r8,qword ptr [rsp+90h]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiDeliverApc+2ca
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x19_20_nt!KiDeliverApc+2ca
BUCKET_ID: X64_0x19_20_nt!KiDeliverApc+2ca
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\malignant\Windows_NT6_BSOD_jcgriff2\010912-27814-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c07000 PsLoadedModuleList = 0xfffff800`02e4c670
Debug session time: Mon Jan 9 14:25:29.691 2012 (UTC - 7:00)
System Uptime: 0 days 1:45:37.127
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002db21f9, fffff88002334ba0, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExAllocatePoolWithTag+119 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002db21f9, Address of the instruction which caused the bugcheck
Arg3: fffff88002334ba0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExAllocatePoolWithTag+119
fffff800`02db21f9 884303 mov byte ptr [rbx+3],al
CONTEXT: fffff88002334ba0 -- (.cxr 0xfffff88002334ba0)
rax=0000000000000002 rbx=0000000000fffff0 rcx=dc0dd860020dcc1f
rdx=0000000001000001 rsi=0000000000000007 rdi=0000000000000000
rip=fffff80002db21f9 rsp=fffff88002335580 rbp=fffff80002dfa940
r8=0000000001000000 r9=fffff80002c07000 r10=fffff80002dfa940
r11=fffff88002335660 r12=fffff80002e0e340 r13=0000000000000000
r14=0000000000000002 r15=0000000066496553
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!ExAllocatePoolWithTag+0x119:
fffff800`02db21f9 884303 mov byte ptr [rbx+3],al ds:002b:00000000`00fffff3=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002db21f9
STACK_TEXT:
fffff880`02335580 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExAllocatePoolWithTag+0x119
FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+119
fffff800`02db21f9 884303 mov byte ptr [rbx+3],al
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExAllocatePoolWithTag+119
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88002334ba0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExAllocatePoolWithTag+119
BUCKET_ID: X64_0x3B_nt!ExAllocatePoolWithTag+119
Followup: MachineOwner
---------
Typically, black screen errors are due to a display driver problem. Go through the following steps.